Back to CVE records
Medium 4.3Published Aug 11, 2026
CVE-2026-11738Insufficient input validation in certain NETGEAR Nighthawk routers allows administrators to tamper with the device.
Updated under an hour ago ()
Does this affect you?
It affects NETGEAR R7000 and 28 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Start free and add your stack
Free account, 1 product
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.
- CVSS
- 4.3 MEDIUM (v4.0, CNA)CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:L/U:Amber
- Weakness (CWE)
- CWE-20
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- NETGEAR
- NVD analysis
- Analyzed
- Record last updated
- Aug 12, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
NETGEAR R7000 netgear:r7000 (from the name) | all versions | CNA record |
NETGEAR RAXE500 netgear:raxe500 (from the name) | before V1.2.14.114 | CNA record |
NETGEAR RS700 netgear:rs700 (from the name) | before V1.0.7.66 | CNA record |
netgear be9300_firmware netgear:be9300_firmware | before 1.0.1.84 | NVD |
netgear mr60_firmware netgear:mr60_firmware | before 1.1.8.142 | NVD |
netgear ms60_firmware netgear:ms60_firmware | before 1.1.8.142 | NVD |
netgear r6700ax_firmware netgear:r6700ax_firmware | before 1.0.18.164 | NVD |
netgear rax10_firmware netgear:rax10_firmware | before 1.0.5.50 | NVD |
netgear rax120_firmware netgear:rax120_firmware | before 1.2.10.56 | NVD |
netgear rax120v2_firmware netgear:rax120v2_firmware | before 1.2.10.56 | NVD |
netgear rax20_firmware netgear:rax20_firmware | before 1.0.17.142 | NVD |
netgear rax28_firmware netgear:rax28_firmware | before 1.0.14.108 | NVD |
netgear rax29_firmware netgear:rax29_firmware | before 1.0.14.108 | NVD |
netgear rax30_firmware netgear:rax30_firmware | before 1.0.14.108 | NVD |
netgear rax36s_firmware netgear:rax36s_firmware | before 1.0.5.50 | NVD |
netgear rax43_firmware netgear:rax43_firmware | before 1.0.17.142 | NVD |
netgear rax45_firmware netgear:rax45_firmware | before 1.0.17.142 | NVD |
netgear rax50_firmware netgear:rax50_firmware | before 1.0.17.142 | NVD |
netgear rax70_firmware netgear:rax70_firmware | before 1.0.19.172 | NVD |
netgear rbr760_firmware netgear:rbr760_firmware | before 6.3.8.11 | NVD |
netgear rbs760_firmware netgear:rbs760_firmware | before 6.3.8.11 | NVD |
netgear rs100_firmware netgear:rs100_firmware | before 1.0.1.80 | NVD |
netgear rs200_firmware netgear:rs200_firmware | before 1.0.1.90 | NVD |
netgear rs280_firmware netgear:rs280_firmware | before 1.0.1.90 | NVD |
netgear rs300_firmware netgear:rs300_firmware | before 1.0.1.90 | NVD |
netgear rs500_firmware netgear:rs500_firmware | before 1.0.1.90 | NVD |
netgear rs600_firmware netgear:rs600_firmware | before 1.0.1.90 | NVD |
netgear rs70_firmware netgear:rs70_firmware | before 1.0.1.80 | NVD |
netgear rs90_firmware netgear:rs90_firmware | before 1.0.1.80 | NVD |
References
- https://www.netgear.com/support/product/r7000/product, patch
- https://www.netgear.com/support/product/rs700/product, patch
- https://www.netgear.com/support/product/raxe500/product, patch
- https://kb.netgear.com/000070887/August-2026-NETGEAR-Security-Advisoryvendor-advisory, patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.